CVE-2026-19662
Publication date 16 September 2026
Last updated 5 November 2026
Ubuntu priority
Description
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| bind9 | 26.10 stonking |
Fixed in 1:9.20.24-1ubuntu3.1
|
| 26.04 LTS resolute |
Fixed in 1:9.20.24-1ubuntu0.4
|
|
| 24.04 LTS noble |
Fixed in 1:9.18.39-0ubuntu0.24.04.8
|
|
| 22.04 LTS jammy |
Fixed in 1:9.18.39-0ubuntu0.22.04.7
|
|
| 20.04 LTS focal |
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
|
| isc-dhcp | 26.10 stonking | Not in release |
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
|
| bind9-libs | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
alexmurray
As of isc-dhcp-4.4.3-1, isc-dhcp vendors bind9 libs
mdeslaur
in focal and jammy, isc-dhcp uses the bind9-libs package
john-breton
Introduced by the CVE-2026-11622 fix (slab header reference counting). Releases that do not have that fix yet are marked needed so both fixes ship together. trusty, xenial and bionic are not getting the CVE-2026-11622 fix, so the code is not present there.
mdeslaur
This is unlikely to affect isc-dhcp's use of bind9-libs and the vendored bind9 libs, marking as negligible
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.9 · Medium
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8969-1
- Bind vulnerabilities
- 3 November 2026
- USN-8929-1
- Bind vulnerabilities
- 14 October 2026